AX: When updating the isolated tree with a remove and add of the same object, the wrapper is not re-attached

• Component: Accessibility
• Status: RESOLVED FIXED

[Tyler Wilcock]

In AXIsolatedTree::applyPendingChanges, we process node and subtree removals before tree additions. When doing these removals, we detach the object and wrapper from each other. This is fine unless that same object is slated to be added again (e.g. it was moved in the DOM), as we don't always re-attach a wrapper. [WebAccessibilityObjectWrapperBase axBackingObject] will always return nil for objects in this state.

[Radar WebKit Bug Importer]

<rdar://problem/88601894>

[Tyler Wilcock]

Created attachment 451175 [details]
Patch

[Andres Gonzalez]

(In reply to Tyler Wilcock from comment #2)
> Created attachment 451175 [details]
> Patch

-        if (!item.isolatedObject->wrapper()) {
-            // The new object hasn't been attached a wrapper yet, so attach it.
+        // If the new object hasn't been attached to a wrapper yet, or if it was detached from
+        // the wrapper when processing removals above, we must attach / re-attach it.
+        if (!item.isolatedObject->wrapper() || detachedObjectIDs.contains(axID))
             item.isolatedObject->attachPlatformWrapper(wrapper.get());

Good catch! I think though that it would be a better solution to check for whether the wrapper has an isolatedObject, and if not, attach the isolated object to the wrapper, instead of creating this new collection and looking up the AXID.

[Tyler Wilcock]

Created attachment 451204 [details]
Patch

[Tyler Wilcock]

Created attachment 451206 [details]
Patch

[EWS]

Committed r289368 (246956@main): <https://commits.webkit.org/246956@main>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 451206 [details].